Splunk Search

Timechart X Axis - Limiting the Time Range Plot

nibinabr
Communicator

I'm performing a search and plotting a timechart

index=hello_index sourcetype=hello_sourcetype event_id="001" now="12/16/2014:00:00:00" earliest="-1d@d" latest="+2d@d"| ...... |.....|
..| eval _time=time_stamp_I_calculated|timechart sum(something)

I have a search over 72 hrs because I don't exactly know when the event_id "001" happened. I modified _time so that it contains the timestamps of my interest during my search.

Problem
Timechart plots time on the x axis for the 72 hr window(from 15th Dec to 17th Dec).

Question
Is there a way to plot the Xaxis using time range of my interest (from the min value to the max value of _time) and not the 72 hr window.

Tags (1)

tachifelix
Path Finder

try something like this:

 .....|timechart span=1d cont=f sum(something)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

See the documentation on the timechart command here and see the option "cont".

http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Timechart#Optional_arguments

Its defaults to true and forces timechart to span over the timerange. Making it false or f will trim your chart from min to max value of _time.

nibinabr
Communicator

I'm not exactly sure why cont didn't work well for me. I solved this issue by doing a sub search that returns the earliest and latest time and use that as the earliest and latest values for the parent search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...